man/sysctl.d.xml

@@ -24,16 +24,6 @@
     <para><filename>/etc/sysctl.d/*.conf</filename></para>
     <para><filename>/run/sysctl.d/*.conf</filename></para>
     <para><filename>/usr/lib/sysctl.d/*.conf</filename></para>
-
-    <programlisting>key.name.under.proc.sys = some value
-key/name/under/proc/sys = some value
-key/middle.part.with.dots/foo = 123
-key.middle/part/with/dots.foo = 123
--key.that.will.not.fail = value
-key.pattern.*.with.glob = whatever
--key.pattern.excluded.with.glob
-key.pattern.overriden.with.glob = custom
-</programlisting>
   </refsynopsisdiv>
 
   <refsect1>
@@ -54,32 +44,34 @@ key.pattern.overriden.with.glob = custom
     first non-whitespace character is <literal>#</literal> or
     <literal>;</literal> are ignored.</para>
 
-    <para>Note that either <literal>/</literal> or <literal>.</literal> may be used as separators within
+    <para>Note that either <literal>/</literal> or
-    sysctl variable names. If the first separator is a slash, remaining slashes and dots are left intact. If
+    <literal>.</literal> may be used as separators within sysctl
-    the first separator is a dot, dots and slashes are interchanged.
+    variable names. If the first separator is a slash, remaining
-    <literal>kernel.domainname=foo</literal> and <literal>kernel/domainname=foo</literal> are equivalent and
+    slashes and dots are left intact. If the first separator is a dot,
-    will cause <literal>foo</literal> to be written to
+    dots and slashes are interchanged.
+    <literal>kernel.domainname=foo</literal> and
+    <literal>kernel/domainname=foo</literal> are equivalent and will
+    cause <literal>foo</literal> to be written to
     <filename>/proc/sys/kernel/domainname</filename>. Either
     <literal>net.ipv4.conf.enp3s0/200.forwarding</literal> or
-    <literal>net/ipv4/conf/enp3s0.200/forwarding</literal> may be used to refer to
+    <literal>net/ipv4/conf/enp3s0.200/forwarding</literal> may be used
-    <filename>/proc/sys/net/ipv4/conf/enp3s0.200/forwarding</filename>. A glob
+    to refer to
-    <citerefentry><refentrytitle>glob</refentrytitle><manvolnum>7</manvolnum></citerefentry> pattern may be
+    <filename>/proc/sys/net/ipv4/conf/enp3s0.200/forwarding</filename>.
-    used to write the same value to all matching keys. Keys for which an explicit pattern exists will be
+    </para>
-    excluded from any glob matching. In addition, a key may be explicitly excluded from being set by any
-    matching glob patterns by specifying the key name prefixed with a <literal>-</literal> character and not
-    followed by <literal>=</literal>, see SYNOPSIS.</para>
 
-    <para>Any access permission errors and attempts to write variables not present on the local system are
+    <para>Any access permission errors and attempts to write variables not defined on the local system are
-    logged, but do not cause the service to fail. Debug log level is used, which means that the message will
+    logged, but do not cause the service to fail. Moreover, if a variable assignment is prefixed with a
-    not show up at all by default. Moreover, if a variable assignment is prefixed with a single
+    single <literal>-</literal> character, failure to set the variable will be logged, but will not cause the
-    <literal>-</literal> character, any failure to set the variable will be logged at debug level, but will
+    service to fail. All other errors when setting variables cause the service to return failure at the end
-    not cause the service to fail. All other errors when setting variables are logged with higher priority
+    (other variables are still processed).</para>
-    and cause the service to return failure at the end (other variables are still processed).</para>
 
-    <para>The settings configured with <filename>sysctl.d</filename> files will be applied early on boot. The
+    <para>The settings configured with <filename>sysctl.d</filename>
-    network interface-specific options will also be applied individually for each network interface as it
+    files will be applied early on boot. The network
-    shows up in the system. (More specifically, <filename>net.ipv4.conf.*</filename>,
+    interface-specific options will also be applied individually for
-    <filename>net.ipv6.conf.*</filename>, <filename>net.ipv4.neigh.*</filename> and
+    each network interface as it shows up in the system. (More
+    specifically, <filename>net.ipv4.conf.*</filename>,
+    <filename>net.ipv6.conf.*</filename>,
+    <filename>net.ipv4.neigh.*</filename> and
     <filename>net.ipv6.neigh.*</filename>).</para>
 
     <para>Many sysctl parameters only become available when certain
@@ -156,26 +148,6 @@ net.bridge.bridge-nf-call-arptables = 0
       (starting with kernel 3.18), so simply not loading the module is
       sufficient to avoid filtering.</para>
     </example>
-
-    <example>
-      <title>Set network routing properties for all interfaces</title>
-      <para><filename>/etc/systemd/20-rp_filter.conf</filename>:</para>
-
-      <programlisting>net.ipv4.conf.default.rp_filter = 2
-net.ipv4.conf.*.rp_filter = 2
--net.ipv4.conf.all.rp_filter
-net.ipv4.conf.hub0.rp_filter = 1
-</programlisting>
-
-      <para>The <option>rp_filter</option> key will be set to "2" for all interfaces, except "hub0". We set
-      <filename>net.ipv4.conf.default.rp_filter</filename> first, so any interfaces which are added
-      <emphasis>later</emphasis> will get this value (this also covers any interfaces detected while we're
-      running). The glob matches any interfaces which were detected <emphasis>earlier</emphasis>. The glob
-      will also match <filename>net.ipv4.conf.all.rp_filter</filename>, which we don't want to set at all, so
-      it is explicitly excluded. And "hub0" is excluded from the glob because it has an explicit setting.
-      </para>
-    </example>
-
   </refsect1>
 
   <refsect1>

presets/90-systemd.preset

@@ -7,9 +7,8 @@
 #  the Free Software Foundation; either version 2.1 of the License, or
 #  (at your option) any later version.
 
-# Settings for systemd units distributed with systemd itself. Most of these
+# These ones should be enabled by default, even if distributions
-# should be enabled by default, even if the distribution follows a general
+# generally follow a default-off policy.
-# default-off policy.
 
 enable remote-fs.target
 enable remote-cryptsetup.target
@@ -35,18 +34,3 @@ disable syslog.socket
 disable systemd-journal-gatewayd.*
 disable systemd-journal-remote.*
 disable systemd-journal-upload.*
-
-# Passive targets: always off by default, since they should only be pulled in
-# by dependent units.
-
-disable cryptsetup-pre.target
-disable getty-pre.target
-disable local-fs-pre.target
-disable network.target
-disable network-pre.target
-disable nss-lookup.target
-disable nss-user-lookup.target
-disable remote-fs-pre.target
-disable rpcbind.target
-disable time-set.target
-disable time-sync.target

presets/user/90-systemd.preset

@@ -7,15 +7,8 @@
 #  the Free Software Foundation; either version 2.1 of the License, or
 #  (at your option) any later version.
 
-# Settings for systemd units distributed with systemd itself. These should be
+# These ones should be enabled by default, even if distributions
-# enabled by default, even if the distribution follows a general default-off
+# generally follow a default-off policy.
-# policy.
 
 enable systemd-tmpfiles-setup.service
 enable systemd-tmpfiles-clean.timer
-
-# Passive targets: always off by default, since they should only be pulled in
-# by dependent units.
-
-disable graphical-session-pre.target
-disable graphical-session.target

src/hibernate-resume/hibernate-resume-generator.c

@@ -93,7 +93,7 @@ static int process_resume(void) {
                 return log_error_errno(r, "Failed to generate unit name: %m");
 
         r = write_drop_in(arg_dest, device_unit, 40, "device-timeout",
-                          "# Automatically generated by systemd-hibernate-resume-generator\n\n"
+                          "# Automatically generated by systemd-cryptsetup-generator\n\n"
                           "[Unit]\nJobTimeoutSec=0");
         if (r < 0)
                 log_warning_errno(r, "Failed to write device timeout drop-in: %m");

src/shared/sysctl-util.c

@@ -9,7 +9,6 @@
 #include "fileio.h"
 #include "log.h"
 #include "macro.h"
-#include "path-util.h"
 #include "string-util.h"
 #include "sysctl-util.h"
 
@@ -17,27 +16,22 @@ char *sysctl_normalize(char *s) {
         char *n;
 
         n = strpbrk(s, "/.");
-
         /* If the first separator is a slash, the path is
          * assumed to be normalized and slashes remain slashes
          * and dots remains dots. */
+        if (!n || *n == '/')
+                return s;
 
-        if (n && *n == '.')
+        /* Otherwise, dots become slashes and slashes become
-                /* Dots become slashes and slashes become dots. Fun. */
+         * dots. Fun. */
-                do {
+        while (n) {
                 if (*n == '.')
                         *n = '/';
                 else
                         *n = '.';
 
                 n = strpbrk(n + 1, "/.");
-                } while (n);
+        }
-
-        path_simplify(s, true);
-
-        /* Kill the leading slash, but keep the first character of the string in the same place. */
-        if (*s == '/' && *(s+1))
-                memmove(s, s+1, strlen(s));
 
         return s;
 }

src/shared/sysctl-util.h

@@ -6,7 +6,7 @@
 
 #include "macro.h"
 #include "stdio-util.h"
-#include "string-util.h"
+#include "util.h"
 
 char *sysctl_normalize(char *s);
 int sysctl_read(const char *property, char **value);

src/sysctl/sysctl.c

@@ -14,7 +14,6 @@
 #include "errno-util.h"
 #include "fd-util.h"
 #include "fileio.h"
-#include "glob-util.h"
 #include "hashmap.h"
 #include "log.h"
 #include "main-func.h"
@@ -50,6 +49,63 @@ static Option *option_free(Option *o) {
 DEFINE_TRIVIAL_CLEANUP_FUNC(Option*, option_free);
 DEFINE_HASH_OPS_WITH_VALUE_DESTRUCTOR(option_hash_ops, char, string_hash_func, string_compare_func, Option, option_free);
 
+static Option *option_new(
+                const char *key,
+                const char *value,
+                bool ignore_failure) {
+
+        _cleanup_(option_freep) Option *o = NULL;
+
+        assert(key);
+        assert(value);
+
+        o = new(Option, 1);
+        if (!o)
+                return NULL;
+
+        *o = (Option) {
+                .key = strdup(key),
+                .value = strdup(value),
+                .ignore_failure = ignore_failure,
+        };
+
+        if (!o->key || !o->value)
+                return NULL;
+
+        return TAKE_PTR(o);
+}
+
+static int apply_all(OrderedHashmap *sysctl_options) {
+        Option *option;
+        Iterator i;
+        int r = 0;
+
+        ORDERED_HASHMAP_FOREACH(option, sysctl_options, i) {
+                int k;
+
+                k = sysctl_write(option->key, option->value);
+                if (k < 0) {
+                        /* If the sysctl is not available in the kernel or we are running with reduced
+                         * privileges and cannot write it, then log about the issue, and proceed without
+                         * failing. (EROFS is treated as a permission problem here, since that's how
+                         * container managers usually protected their sysctls.) In all other cases log an
+                         * error and make the tool fail. */
+
+                        if (option->ignore_failure || k == -EROFS || ERRNO_IS_PRIVILEGE(k))
+                                log_debug_errno(k, "Couldn't write '%s' to '%s', ignoring: %m", option->value, option->key);
+                        else if (k == -ENOENT)
+                                log_info_errno(k, "Couldn't write '%s' to '%s', ignoring: %m", option->value, option->key);
+                        else {
+                                log_error_errno(k, "Couldn't write '%s' to '%s': %m", option->value, option->key);
+                                if (r == 0)
+                                        r = k;
+                        }
+                }
+        }
+
+        return r;
+}
+
 static bool test_prefix(const char *p) {
         char **i;
 
@@ -62,7 +118,6 @@ static bool test_prefix(const char *p) {
                 t = path_startswith(*i, "/proc/sys/");
                 if (!t)
                         t = *i;
-
                 if (path_startswith(p, t))
                         return true;
         }
@@ -70,117 +125,6 @@ static bool test_prefix(const char *p) {
         return false;
 }
 
-static Option *option_new(
-                const char *key,
-                const char *value,
-                bool ignore_failure) {
-
-        _cleanup_(option_freep) Option *o = NULL;
-
-        assert(key);
-
-        o = new(Option, 1);
-        if (!o)
-                return NULL;
-
-        *o = (Option) {
-                .key = strdup(key),
-                .value = value ? strdup(value) : NULL,
-                .ignore_failure = ignore_failure,
-        };
-
-        if (!o->key)
-                return NULL;
-        if (value && !o->value)
-                return NULL;
-
-        return TAKE_PTR(o);
-}
-
-static int sysctl_write_or_warn(const char *key, const char *value, bool ignore_failure) {
-        int r;
-
-        r = sysctl_write(key, value);
-        if (r < 0) {
-                /* If the sysctl is not available in the kernel or we are running with reduced privileges and
-                 * cannot write it, then log about the issue, and proceed without failing. (EROFS is treated
-                 * as a permission problem here, since that's how container managers usually protected their
-                 * sysctls.) In all other cases log an error and make the tool fail. */
-                if (ignore_failure || r == -EROFS || ERRNO_IS_PRIVILEGE(r))
-                        log_debug_errno(r, "Couldn't write '%s' to '%s', ignoring: %m", value, key);
-                else if (r == -ENOENT)
-                        log_info_errno(r, "Couldn't write '%s' to '%s', ignoring: %m", value, key);
-                else
-                        return log_error_errno(r, "Couldn't write '%s' to '%s': %m", value, key);
-        }
-
-        return 0;
-}
-
-static int apply_all(OrderedHashmap *sysctl_options) {
-        Option *option;
-        Iterator i;
-        int r = 0;
-
-        ORDERED_HASHMAP_FOREACH(option, sysctl_options, i) {
-                int k;
-
-                /* Ignore "negative match" options, they are there only to exclude stuff from globs. */
-                if (!option->value)
-                        continue;
-
-                if (string_is_glob(option->key)) {
-                        _cleanup_strv_free_ char **paths = NULL;
-                        _cleanup_free_ char *pattern = NULL;
-                        char **s;
-
-                        pattern = path_join("/proc/sys", option->key);
-                        if (!pattern)
-                                return log_oom();
-
-                        k = glob_extend(&paths, pattern);
-                        if (k < 0) {
-                                if (option->ignore_failure || ERRNO_IS_PRIVILEGE(r))
-                                        log_debug_errno(k, "Failed to resolve glob '%s', ignoring: %m",
-                                                        option->key);
-                                else {
-                                        log_error_errno(k, "Couldn't resolve glob '%s': %m",
-                                                        option->key);
-                                        if (r == 0)
-                                                r = k;
-                                }
-
-                        } else if (strv_isempty(paths))
-                                log_debug("No match for glob: %s", option->key);
-
-                        STRV_FOREACH(s, paths) {
-                                const char *key;
-
-                                assert_se(key = path_startswith(*s, "/proc/sys"));
-
-                                if (!test_prefix(key))
-                                        continue;
-
-                                if (ordered_hashmap_contains(sysctl_options, key)) {
-                                        log_info("Not setting %s (explicit setting exists).", key);
-                                        continue;
-                                }
-
-                                k = sysctl_write_or_warn(key, option->value, option->ignore_failure);
-                                if (r == 0)
-                                        r = k;
-                        }
-
-                } else {
-                        k = sysctl_write_or_warn(option->key, option->value, option->ignore_failure);
-                        if (r == 0)
-                                r = k;
-                }
-        }
-
-        return r;
-}
-
 static int parse_file(OrderedHashmap **sysctl_options, const char *path, bool ignore_enoent) {
         _cleanup_fclose_ FILE *f = NULL;
         unsigned c = 0;
@@ -200,7 +144,7 @@ static int parse_file(OrderedHashmap **sysctl_options, const char *path, bool ig
         for (;;) {
                 _cleanup_(option_freep) Option *new_option = NULL;
                 _cleanup_free_ char *l = NULL;
-                bool ignore_failure = false;
+                bool ignore_failure;
                 Option *existing;
                 char *p, *value;
                 int k;
@@ -221,35 +165,25 @@ static int parse_file(OrderedHashmap **sysctl_options, const char *path, bool ig
                         continue;
 
                 value = strchr(p, '=');
-                if (value) {
+                if (!value) {
-                        if (p[0] == '-') {
+                        log_syntax(NULL, LOG_WARNING, path, c, 0, "Line is not an assignment, ignoring: %s", p);
-                                ignore_failure = true;
-                                p++;
-                        }
-
-                        *value = 0;
-                        value++;
-                        value = strstrip(value);
-
-                } else {
-                        if (p[0] == '-')
-                                /* We have a "negative match" option. Let's continue with value==NULL. */
-                                p++;
-                        else {
-                                log_syntax(NULL, LOG_WARNING, path, c, 0,
-                                           "Line is not an assignment, ignoring: %s", p);
                         if (r == 0)
                                 r = -EINVAL;
                         continue;
                 }
-                }
+
+                *value = 0;
+                value++;
 
                 p = strstrip(p);
-                p = sysctl_normalize(p);
+                ignore_failure = p[0] == '-';
+                if (ignore_failure)
+                        p++;
 
-                /* We can't filter out globs at this point, we'll need to do that later. */
+                p = sysctl_normalize(p);
-                if (!string_is_glob(p) &&
+                value = strstrip(value);
-                    !test_prefix(p))
+
+                if (!test_prefix(p))
                         continue;
 
                 if (ordered_hashmap_ensure_allocated(sysctl_options, &option_hash_ops) < 0)

src/test/meson.build

@@ -325,10 +325,6 @@ tests += [
          [],
          []],
 
-        [['src/test/test-sysctl-util.c'],
-         [],
-         []],
-
         [['src/test/test-user-util.c'],
          [],
          []],

src/test/test-sysctl-util.c

@@ -1,44 +0,0 @@
-/* SPDX-License-Identifier: LGPL-2.1+ */
-
-#include "strv.h"
-#include "sysctl-util.h"
-#include "tests.h"
-
-static const char* cases[] = {
-        "a.b.c", "a/b/c",
-        "a/b/c", "a/b/c",
-        "a/b.c/d", "a/b.c/d",
-        "a.b/c.d", "a/b.c/d",
-
-        "net.ipv4.conf.enp3s0/200.forwarding", "net/ipv4/conf/enp3s0.200/forwarding",
-        "net/ipv4/conf/enp3s0.200/forwarding", "net/ipv4/conf/enp3s0.200/forwarding",
-
-        "a...b...c", "a/b/c",
-        "a///b///c", "a/b/c",
-        ".a...b...c", "a/b/c",
-        "/a///b///c", "a/b/c",
-        NULL,
-};
-
-static void test_sysctl_normalize(void) {
-        log_info("/* %s */", __func__);
-
-        const char **s, **expected;
-        STRV_FOREACH_PAIR(s, expected, cases) {
-                _cleanup_free_ char *t;
-
-                assert_se(t = strdup(*s));
-                assert_se(sysctl_normalize(t) == t);
-
-                log_info("\"%s\" → \"%s\", expected \"%s\"", *s, t, *expected);
-                assert_se(streq(t, *expected));
-        }
-}
-
-int main(int argc, char *argv[]) {
-        test_setup_logging(LOG_INFO);
-
-        test_sysctl_normalize();
-
-        return 0;
-}

sysctl.d/50-default.conf

@@ -22,19 +22,13 @@ kernel.sysrq = 16
 kernel.core_uses_pid = 1
 
 # Source route verification
-net.ipv4.conf.default.rp_filter = 2
+net.ipv4.conf.all.rp_filter = 2
-net.ipv4.conf.*.rp_filter = 2
--net.ipv4.conf.all.rp_filter
 
 # Do not accept source routing
-net.ipv4.conf.default.accept_source_route = 0
+net.ipv4.conf.all.accept_source_route = 0
-net.ipv4.conf.*.accept_source_route = 0
--net.ipv4.conf.all.accept_source_route
 
 # Promote secondary addresses when the primary address is removed
-net.ipv4.conf.default.promote_secondaries = 1
+net.ipv4.conf.all.promote_secondaries = 1
-net.ipv4.conf.*.promote_secondaries = 1
--net.ipv4.conf.all.promote_secondaries
 
 # ping(8) without CAP_NET_ADMIN and CAP_NET_RAW
 # The upper limit is set to 2^31-1. Values greater than that get rejected by